Italian Surveillance Software Maker Falls Victim To Doxing Attack

Milan-based Hacking Team tells customers to stop using its products after leaked documents reveal the product's source code and the company's history of selling to governments with records of human rights abuses.

Source code for the Remote Control System (RCS) surveillance software as well as details of the international government agencies that purchased it were revealed today in an apparent doxing attack on Hacking Team, the Milan-based makers of RCS.

The dumped data revealed that Hacking Team had sold its products to several countries with poor human rights records, as well as to the FBI and U.S. Drug Enforcement Administration (DEA). Unnamed sources told Motherboard that Hacking Team has told customers to suspend use of the software, of which the newest version is named Galileo, and was previously known as Da Vinci.

In total, attackers uploaded to BitTorrent 400 gigabytes of data (and might have stolen as much as a terabyte), which also included internal documents, audio recordings, email correspondence, and employee passwords. One of the leaked files was a PowerPoint presentation explaining how the company was able to intercept communications on the Tor network, which is supposed to be anonymous. One of the leaked files was a spreadsheet, from the end of 2014, of active and inactive clients. Among those clients were police and state agencies in nations with records of human rights abuses, including Russia, Egypt, Sudan, Ethiopia, Kazakhstan, Morocco, Nigeria, and Saudi Arabia.

The attackers also hijacked Hacking Team's Twitter account, posting "Since we have nothing to hide, we're publishing all our emails, files and source code." Tweets posted by the attackers have been deleted, but the account appears to still be active as of publishing time.

Motherboard's anonymous source says the attacker seems to have compromised the client machines of two of Hacking Team's system administrators, who had complete access to the company's files. While the company has asked customers to suspend use of the product, the source said "The company, in fact, has 'a backdoor' into every customer’s software, giving it ability to suspend it or shut it down—something that even customers aren’t told about."

Some are comparing this event to another recent attack against a cybersecurity company: the Duqu 2.0 nation-state attacks against Kaspersky Lab. Most are focusing on the evidence the attackers have provided for prior accusations about Hacking Team's lack of ethics when it comes to selling its product.

As Electronic Frontier Foundation (EFF) global policy analyst Eva Galperin said on Twitter, "Thank you, Anti-Surveillance Santa, for bringing me so many leaked files for Anti-Surveillance Christmas. I have been very good this year."

Hacking Team says, "We provide our software only to governments or government agencies. We do not sell products to individuals or private businesses. We do not sell products to governments or to countries blacklisted by the U.S., E.U., U.N., NATO or ASEAN." Yet, it has been suspected of breaking that last rule before. Reporters Without Borders added the company to its "Enemies of the Internet" list in 2012.

The RCS product is essentially spyware. The company itself describes RCS as "a solution designed to evade encryption by means of an agent directly installed on the device to monitor. Evidence collection on monitored devices is stealth and transmission of collected data from the device to the RCS server is encrypted and untraceable."

Some of the governments listed in Hacking Team's purported customer list are given scathing reviews in the United Nations' Human Rights Watch 2015 World Report. For example, the report says that Egypt is in a "human rights crisis, the most serious in the country’s modern history" and described how "security forces and an increasingly politicized judiciary ... invoked national security to muzzle nearly all dissent." The report states "Sudan saw no progress in its abysmal rights record ... and authorities continued to stifle civil society and independent media." As for Russia, it states "The Kremlin took another leap backward in 2014 by intensifying its crackdown on civil society, media, and the Internet."

Great Cannon

Then there's China, which has developed its own surveillance tool, the Great Cannon.

"You hear about China and cyber espionage, [organizations] getting breached, but no one really talks too often about other things they are doing that are really outlandish, like the redirection of traffic to block things" that are counter to the Chinese government regime, Adam Meyers, vice president of intelligence at CrowdStrike told Dark Reading.

"The Chinese have basically taken a lot of DNS traffic generated by the Great Firewall," he says. The massive, five-day distributed denial-of-service attack earlier this year on Github was an example where China employed its Great Cannon to block Chinese citizens from accessing a tool housed there for bypassing the Great Firewall. "That was a pretty aggressive move on the part of China."

So when a Chinese citizen tries to visit a site that the Chinese government doesn’t approve of, it redirects the traffic. "They are redirecting traffic and attacking [sites] that are not in line with" the government’s views, he says.

"It’s not really an espionage tool. But it could be a smokescreen for a broader espionage campaign, possibly," Meyers says of China's Great Cannon.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

As much as I'm pleased that Hacking Team's dirty laundry has been aired here, anyone annoyed by what its done should direct their anger equally to US and British intelligence agencies, which have been doing the same sort of spying on their own citizens for the better part of a decade at this point.

Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.

Published: 2017-05-09NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.